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DETAILED ACTION 

1 . Claims 1 -20 are presented for examination. 

Claim Rejections - 35 USC § 102 

2. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(b) the invention was patented or described in a printed publication in this or a foreign country or in public 
use or on sale in this country, more than one year prior to the date of application for patent in the United 
States. 

3. Claims 1-2, 4-5, 7-10,12-13 and 15-18 are rejected under 35 U.S.C. 102(e) as * 
being anticipated by Gupta (US 6,516,315). 

4. As per claims 1 and 7-8, Gupta teaches the invention as claimed including a 
computer-implemented method for managing access to computer-provided services for 
a plurality of requesters [col. 2, lines 27-60], comprising: 

defining combinations of access characteristics [i.e., role] and associating each 
of the combinations with a security level [col. 4, line 52 -col. 5, line 14; i.e., different 
roles have different access rights], associating each of the services [i.e., data object] 
with one of the security levels [col. 4, lines 45-52; col. 6, line 51 - col. 7, line 44; i.e., a 
security classification label]; 
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processing a login request from a requester, whereby a session is initiated [132 f 
134, Fig. 8; col. 3, lines 21-28; col. 9, lines 61-67]; 

determining access characteristics of the session [i.e., since each user can have 
plurality relationship with data object, system has to determine which role the user is for 
a specific session] , receiving a request for one of the services from the requester and 
granting access to the one of the services [i.e., data objects] if the access 
characteristics of the session [i.e., role] are associated with a security level that satisfies 
the security level associated with the one of the services [i.e., compare classification 
level to determining if granting access to the service or not; col. 3, lines 21-34; col. 7, 
line 50 - col. 8, line 4; col. 10, lines 1-36]. 

5. As per claim 2, Gupta teaches the step of prompting the requester for 
authentication data if the access characteristics of the session are associated with a 
security level that does not satisfy the security level requirement associated with the 
one of the services [inherent in Gupta, col. 1 0, line 58 - col. 1 1 , line 4; i.e., the available 
function which user optionally returned includes prompting the requester for 
authentication data]. 

6. As per claim 4, Gupta teaches the access characteristics include ownership 
rights of a device with which the session is maintained [col. 7, line 47 - col. 8, line 32]. 
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7. As per claim 5, Gupta teaches the access characteristics include characteristics 
of a network over which the session is maintained [col. 12 t lines 17-21]. 

8. As per claim 9, Gupta teaches the invention as claimed including a plurality of 
communications devices coupled to one or more computer-provided services via a 
gateway arrangement [92, Fig. 6], a method for managing access to the services for 
a plurality of users at the communications devices [col. 2, lines 27-60], comprising: 

defining combinations of access characteristics and associating each of the 
combinations with a security level at the gateway arrangement, associating each of the 
services with one of the security levels at the gateway arrangement [col. 4, lines 45-52; 
col.6, line 51 - col. 7, line 44]; 

processing a login request from a user at the gateway arrangement, whereby a 
session is initiated between a communications device and a service [col. 3, lines 21-28; 
col. 9, lines 61-67]; and 

determining access characteristics of the session at the gateway arrangement, 
receiving at the gateway arrangement a request for one of the services from the user of 
the communications device and granting access to the one of the services if the access 
characteristics of the session are associated with a security level that satisfies the 
security level associated with the one of the services [col. 3, lines 28-34; col. 10, lines 1- 
36]. 
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9. As per claims 1 0, 1 2-1 3 and 1 5-1 6, since they are method claims of claims 2, 4-5 
and 7-8, they are rejected for the same basis as claims 2, 4-5 and 7-8 above. 

1 0. As per claims 1 7 and 1 8, since they are apparatus claims of 1 and 9, they are 
rejected for the same basis as claims 1 and 9 above. 

Claim Rejections - 35 USC § 103 

11. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 1 02 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

12. Claims 3, 6, 1 1, 14 and 19-20 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Gupta (US 6,516,315) as applied to claims 1-2, 4-5, 7-10, 12-13 and 
15-18 above. 

13. As per claims 3, 1 1 and 19, Gupta teaches the invention substantially as claimed 
in claim 1. Gupta does not specifically teach the access characteristics include a type of 
device with which the session is maintained. However, it would have been obvious to a 
person of ordinary skill in the art at the time the invention was made to add the 
information of the type of device to access characteristic in Gupta's system because 
doing so would improve the quality of the service by quickly realizing the user's device 
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type and providing relevant service to the user. One of ordinary skill in the art would 
have been motivated to modify Gupta's system with type of device information to 
improve the functionality of the system. 

14. As per claim 6, 14 and 20, Gupta teaches the invention substantially as claimed 
in claim 1 . Gupta does not specifically teach the step of authenticating the requester 
with a selected authentication method, wherein the access characteristics include 
characteristics of the authentication method. However, it would have been obvious to a 
person of ordinary skill in the art at the time the invention was made to including 
authentication method selection in Gupta's system because doing so would improve the 
dynamic ability of the system by allowing users select a method based on their 
preference and need. One of ordinary skill in the art would have been motivated to 
modify Gupta's system with authentication method selection to bring convenience of the 
system. 

Conclusion 

15. Applicant's arguments filed on 12/13 for claims 1-20 have been fully considered 
but they are not deemed to be persuasive. 

1 6. In the remarks, applicant argued in substance that 

(1) Gupta does not teach associated service with access characteristics; 
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(2) Gupta does not teach granting access to the one of the services if the access 
characteristics of the session are associated with a security level that satisfies the 
security level associated with the one of the services; 

(3) Gupta does not teach using security level of a session and the security 
level of a service to trigger prompting a requester for authentication data; 

(4) Gupta does not teach the access characteristics including ownership 
rights of a device with which the session is maintained; 

(5) Gupta does not teach the access characteristics including characteristics 
of a network over which the session is maintained; 

(6) There is apparent showing that the modification for Gupta's system with 
the limitations claimed in claims 3, 6, 11, 14 and 19-20 could be made with a 
reasonable likelihood success. 

17. Examiner respectfully traverses applicant's remarks: 

A. As to point (1), applicant fails to consider the teaching of the Gupta's 
reference for associating the service [i.e., data object] with the access characteristics 
[i.e., role; col. 7, line 50 - col. 8, line 4], in the other word, the relationship between a 
unique role and a data object is clearly defined as applicant claimed in claim 1 . Thus, 
Gupta does teach the argued limitation. 

B. As to point (2), the examiner has explained in this Office Action, see 
relevant paragraph for details. 
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C. As to point (3), the Applicant argued limitation is different from the original 
claimed limitation. The original limitation did not claim using security level of a session 
and the security level of a service to trigger prompting a requester for authentication 
data, it claimed prompting a requester for authentication data when security level of 
access characteristics was not satisfied, i.e., the requester will be prompted only when 
the security level of access characteristics was lower than the security level of the 
request service, otherwise, this step won't be performed. Thus, Gupta does teach this 
limitation, see relevant paragraph for details. 

D. As to points (4) and (5), in this application, the applicant uses ownership 
rights and characteristics of a network to determining a security level of access 
characteristics, i.e., identify the user who is trying to access a particular service. Gupta 
uses role to identify who is that user and what kind right he/she has. Gupta's system 
has same function as applicant claimed. Thus Gupta does teach the argued limitation. 

E. As to point (6), the test for obviousness is not whether the claimed 
invention is expressly suggested in any one or all references but rather what the 
references would have suggested to those of ordinary skill in the art. ( In re Keller 642 
F. 2d 41 3. 208 USPQ 871.881 (CCPA 1981 )). In order to establish a prima facie case, 
the examiner clearly acknowledged that Gupta's reference discloses a method for 
providing services to authenticated users, but the reference does not specifically 
considering device type and selected authentication method. However, all of these 
limitations are well known and obvious to a person of ordinary skill in the art. 
Furthermore, the motivation that provided in Office Action is based on logical reason 
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and knowledge of a ordinary skill in the art, it is not based on a real exist system which 
includes every limitations as applicant claimed in claims 1-20, the examiner has 
explained the reason for the modification in the Office Action. Thus, it is not necessary 
for Examiner to provide evidence to show how the "quality" and "dynamic ability" have 
been improved. Otherwise, there is no any reason to discuss modification if already 
exist an exactly same system. Therefore, the modification for Gupta's system can be 
made with a reasonable likelihood success. 

1 8. Accordingly, THIS ACTION IS MADE FINAL. See MPEP §706.07(a). 
Applicant is reminded of the extension of time policy as set forth in 37 CFR 1 .1 36(a). 

1 9. A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1 .1 36(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the mailing date of this final action. 

20. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Jinsong Hu whose telephone number is (571 ) 272-3965. 
The examiner can normally be reached on 8:00 AM - 5:30 PM. 
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If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, John A. Follansbee can be reached on (571 ) 272-3964. The fax phone 
number for the organization where this application or proceeding is assigned is 703- 
872-9306. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-21 7-91 97 (toll-free). 



Jinsong Hu 




May 10, 2005 



VIET D. VU 
PRIMARY EXAMINER 



